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AMENDMENTS TO THE CLAIMS 



1 1 . (Original) A method for rule-based network management, the method comprising the 

2 computer-implemented steps of: 

3 defining and storing a set of mles in one or more Rule-Based Markup Language 

4 ("RBML") documents, wherein the one or more RBML documents include one or 

5 more tags defining one or more rule elements, and wherein the set of rules 

6 includes: 

7 a symptom-event rule that identifies as a symptom a particular event occurring 

8 within the network; and 

9 a problem-diagnosis rule that defines a problem within the network as a 

10 coirelation between one or more symptoms; 

1 1 collecting and storing symptom-related data about one or more symptoms, wherein 

12 collecting and storing the symptom-related data includes monitoring the network 

13 for one or more network events identified in the symptom-event rule; and 

14 detecting a problem within the network, wherein detecting the problem includes applying 

15 the problem-diagnosis rule to the symptom-related data. 

1 2. (Original) A method as recited in Claim 1, the method further comprising reviewing the 

2 set of rules to identify and resolve a conflict between two or more rules in the set. 

1 3. (Original) A method as recited in Claim 1, the method further comprising storing the one 

2 or more RBML documents in a rule repository, wherein the rule repository includes one or more 

3 directories containing RBML documents. 

1 4. (Original) A method as recited in Claim 1, wherein a RBML document storing the 

2 problem-diagnosis rule includes: 

3 a problem-definition tag describing a problem; and 
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4 a correlation tag identifying the correlation between one or more symptoms, wherein the 

5 one or more symptoms are defined in one or more symptom tags that include one 

6 or more pre-defined indicators associated with the one or more symptoms. 

1 5. (Original) A method as recited in Claim 4, wherein the step of detecting a problem within 

2 the network further comprises the steps of: 

3 comparing the symptom-related data to the one or more pre-defined indicators associated 

4 with a particular symptom to determine whether the particular symptom exists in 

5 the symptom-related data; 

6 repeating the step of comparing the symptom-related data for all symptoms identified in 

7 the correlation tag of the RBML document storing the problem-diagnosis rule; 

8 and 

9 only if all symptoms identified in the correlation tag exist, determining that the problem 
10 identified in the problem-definition tag is detected. 

1 6. (Original) A method as recited in Claim 1, wherein a RBML document storing the 

2 symptom-event rule includes: 

3 an event tag identifying the particular event occurring on the network; and 

4 a symptom tag identifying a symptom as a generalized abstraction of the particular event. 

1 7. (Original) A method as recited in Claim 6, wherein the RBML document storing the 

2 symptom-event rule further includes: 

3 a profile tag identifying a particular network device; and 

4 a command tag identifying a data-collection command, wherein the data-collection 

5 command, when executed on the particular network device, returns symptom- 

6 related data associated with the particular network device. 

1 8. (Original) A method as recited in Claim 1, wherein: 

2 the set of rules further includes a problem-correction rule defining one or more corrective 

3 actions capable of correcting the problem within the network; and 
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4 the method further comprises the step of recommending to a user one or more corrective 

5 actions defined in a RBML document storing the problem-correction rule. 

1 9. (Original) A method as recited in Claim 8, the method further comprising the step of 

2 applying to a network device, without user intervention, one or more corrective actions defined 

3 in the problem-correction rule. 

1 10. (Original) A method as recited in Claim 1, wherein: 

2 the network is a first network in a plurality of networks; and 

3 the method further comprises the steps of: 

4 receiving a request from a user to employ a particular rule in managing a second 

5 network, separate from the first network; and 

6 distributing to a device on the second network the one or more RBML documents 

7 storing the particular rule. 

1 11. (Original) A method for defining a Rule-Based Markup Language ("RBML") to describe 

2 a set of rules for managing a network, the method comprising the computer-implemented steps 

3 of: 

4 creating one or more RBML documents for storing the set of rules, wherein the one or 

5 more RBML documents include one or more tags defining one or more rule 

6 elements, and wherein: 

7 a RBML document storing a symptom-event rule from the set of rules includes: 

8 an event tag identifying a particular event occurring on the network; and 

9 a symptom tag identifying a symptom as a generalized abstraction of the 

10 particular event; and 

11 a RBML document storing a problem-diagnosis rule from the set of rules 

12 includes: 

13 a problem-definition tag describing a problem; and 

14 a correlation tag identifying a correlation between one or more symptoms, 

15 wherein the one or more symptoms are defined in one or more 

1 6 symptom tags that include one or more pre-defined indicators 

17 associated with the one or more symptoms; and 
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18 generating, from information stored in one or more tags of the one or more RBML 

19 documents, one or more sequences of instructions, which instructions, when 

20 executed by one or more processors, cause the one or more processors to carry out 

21 the steps of: 

22 collecting and storing symptom-related data about one or more symptoms, 

23 wherein collecting and storing the symptom-related data includes 

24 monitoring the network for one or more network events identified in the 

25 symptom-event rule; and 

26 detecting a problem within the network, wherein detecting the problem includes 

27 applying the problem-diagnosis rule to the symptom-related data. 

1 12. (Original) A method as recited in Claim 1 1 , wherein the step of detecting a problem 

2 within the network further comprises the steps of: 

3 comparing the symptom-related data to the one or more pre-defined indicators associated 

4 with the one or more symptoms to determine whether a particular symptom exists 

5 in the symptom-related data; 

6 repeating the step of comparing the symptom-related data for all symptoms identified in 

7 the correlation tag of the RBML document storing the problem-diagnosis rule; 

8 and 

9 only if all symptoms identified in the correlation tag exist, determining that the problem 
10 identified in the problem-definition tag is detected. 

1 13. (Original) A method as recited in Claim 11, wherein the RBML document storing the 

2 symptom-event rule further includes: 

3 a profile tag identifying a particular network device; and 

4 a command tag identifying a data-collection command, wherein the data-collection 

5 command, when executed on the particular network device, returns symptom- 

6 related data associated with the particular network device. 

1 14. (Original) A method as recited in Claim 11, wherein: 
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2 the step of creating one or more RBML documents further includes creating a RBML 

3 document for storing a problem-correction rule defining one or more corrective 

4 actions capable of correcting the problem within the network; and 

5 the step of generating instructions includes generating one or more sequences of 

6 instructions, which instructions, when executed by the one or more processors, 

7 cause the one or more processors to carry out the step of recommending to a user 

8 the one or more corrective actions defined in the RBML document storing the 

9 problem-correction rule. 

1 15. (Original) An apparatus for mle-based network management, comprising: 

2 a rule editor for creating and storing, in one or more Rule-Based Markup Language 

3 ("RBML") documents containing one or more tags, a set of rules employed in 

4 managing the network, wherein the set of rules includes: 

5 a symptom-event rule that identifies as a symptom a particular event occurring 

6 within the network; and 

7 a problem-diagnosis rule that defines a problem within the network as a 

8 correlation between one or more symptoms; 

9 one or more processors; 

10 a diagnosis engine including one or more stored sequences of instractions which, when 

1 1 executed by the one or more processors, cause the one or more processors to carry 

12 out the steps of: 

13 collecting and storing symptom-related data about one or more symptoms, 

14 wherein collecting and storing the symptom-related data includes 

15 monitoring the network for one or more network events identified in the 

16 symptom-event rule; and 

17 detecting a problem within the network, wherein detecting the problem includes 

1 8 applying the problem-diagnosis rule to the symptom-related data. 

1 16. (Original) An apparatus as recited in Claim 15, wherein the rule editor is capable of 

2 providing to a user means for reviewing the set of rules to identify and resolve a conflict between 

3 two or more rules in the set. 
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1 17. (Original) An apparatus as recited in Claim 15, wherein: 

2 the problem-diagnosis rule defining the correlation between one or more symptoms 

3 includes one or more pre-defined indicators associated with the one or more 

4 symptoms; and 

5 the diagnosis engine instructions for carrying out the step of detecting a problem within 

6 the network further include instructions for carrying out the steps of: 

7 comparing the symptom-related data to the one or more pre-defined indicators 

8 associated with the one or more symptoms to determine whether a 

9 particular symptom exists in the symptom-related data; 

10 repeating the step of comparing the symptom-related data for all symptoms 

1 1 identified in the problem-diagnosis rule; and 

12 only if all correlated symptoms identified in the problem-diagnosis rule exist, 

13 determining that the problem defined in the problem-diagnosis rule is 

14 detected. 

1 18. (Original) An apparatus as recited in Claim 15, wherein the symptom-event rule further 

2 includes: 

3 information identifying a particular network device; and 

4 a data-collection command, wherein the data-collection command, when executed on the 

5 particular network device, returns symptom-related data associated with the 

6 particular network device. 

1 19. (Original) An apparatus as recited in Claim 15, wherein: 

2 the set of rules further includes a problem-coiTection rule defining one or more corrective 

3 actions capable of correcting the problem within the network; and 

4 the diagnosis engine further includes instructions which, when executed by the one or 

5 more processors, cause the one or more processors to carry out the step of 

6 recommending to a user one or more corrective actions defined in the problem- 

7 correction rule. 
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1 20. (Original) An apparatus as recited in Claim 19, wherein the diagnosis engine further 

2 includes instructions which, when executed by the one or more processors, cause the one or more 

3 processors to carry out the step of applying to a network device, without user intervention, one or 

4 more corrective actions defined in the problem-correction rule. 

1 21 . (Original) An appai-atus as recited in Claim 19, wherein: 

2 the network is a first network in a plurality of networks; and 

3 the appai-atus further includes a mle broker, wherein the rule broker receives a request 

4 from a user to apply a particular mle in managing a second network, separate 

5 from the first network, and distributes to a device on the second network the one 

6 or more RBML documents storing the particular rule. 

1 22. (Currently Amended) A computer-readable storage medium carrying one or more 

2 sequences of instmctions for rule-based network management, which instructions, when 

3 executed by one or more processors, cause the one or more processors to carry out the 

4 steps of: 

5 defining and storing a set of rules in one or more Rule-Based Markup Language 

6 ("RBML") documents, wherein the one or more RBML documents include one or 

7 more tags defining one or more rule elements, and wherein the set of rules 

8 includes: 

9 a symptom-event rule that identifies as a symptom a particular event occurring 

10 within the network; and 

11 a problem-diagnosis mle that defines a problem within the network as a 

12 coixelation between one or more symptoms; 

13 collecting and storing symptom-related data about one or more symptoms, wherein 

14 collecting and storing the symptom-related data includes monitoring the network 

15 for one or more network events identified in the sjonptom-event rule; and 

16 detecting a problem within the network, wherein detecting the problem includes applying 

17 the problem-diagnosis rale to the symptom-related data. 
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1 23. (Currently Amended) A computer-readable storage medium as recited in Claim 22, 

2 further comprising instructions which, when executed by the one or more processors, 

3 cause the one or more processors to carry out the step of reviewing the set of rules to 

4 identify and resolve a conflict between two or more rules in the set. 

1 24. (Currently Amended) A computer-readable storage medium as recited in Claim 22, 

2 further comprising instmctions which, when executed by the one or more processors, 

3 cause the one or more processors to carry out the step of storing the one or more RBML 

4 documents in a mle repository, wherein the rule repository includes one or more 

5 directories containing RBML documents. 

1 25. (Currently Amended) A computer-readable storage medium as recited in Claim 22, 

2 wherein a RBML document storing the problem-diagnosis rule includes: 

3 a problem-definition tag describing a problem; and 

4 a correlation tag identifying the correlation between one or more S5Tnptoms, wherein the 

5 one or more symptoms are defined in one or more symptom tags that include one 

6 or more pre-defined indicators associated with the one or more symptoms. 

1 26. (Currently Amended) A computer-readable storage medium as recited in Claim 25, 

2 further comprising instructions which, when executed by the one or more processors, 

3 cause the one or more processors to carry out the steps of: 

4 comparing the symptom-related data to the one or more pre-defined indicators associated 

5 with a particular symptom to determine whether the particular symptom exists in 

6 the symptom-related data; 

7 repeating the step of comparing the symptom-related data for all symptoms identified in 

8 the correlation tag of the RBML document storing the problem-diagnosis rule; 

9 and 

10 only if all symptoms identified in the correlation tag exist, determining that the problem 

1 1 identified in the problem-definition tag is detected. 
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1 27. (Currently Amended) A computer-readable storage medium as recited in Claim 22, 

2 wherein a RBML document storing the symptom-event rule includes: 

3 an event tag identifying the particular event occurring on the network; and 

4 a symptom tag identifying a symptom as a generalized abstraction of the particular event. 

1 28. (Currently Amended) A computer-readable storage medium as recited in Claim 27, 

2 wherein the RBML document storing the symptom-event rule further includes: 

3 a profile tag identifying a particular network device; and 

4 a command tag identifying a data-collection command, wherein the data-collection 

5 command, when executed on the particular network device, returns symptom- 

6 related data associated with the particular network device. 

1 29. (Currently Amended) A computer-readable storage medium as recited in Claim 22, 

2 wherein: 

3 the set of rules further includes a problem-correction rule defining one or more corrective 

4 actions capable of correcting the problem within the network; and 

5 the computer-readable medium further comprises instructions which, when executed by 

6 the one or more processors, cause the one or more processors to carry out the step 

7 of recommending to a user one or more corrective actions defined in a RBML 

8 document storing the problem-correction rule. 

1 30. (Currently Amended) A computer-readable storage medium as recited in Claim 29, 

2 further comprising instmctions which, when executed by the one or more processors, 

3 cause the one or more processors to carry out the step of applying to a network device, 

4 without user intervention, one or more corrective actions defined in the problem- 

5 correction rule. 

1 31. (Currently Amended) A computer-readable storage medium as recited in Claim 22, 

2 wherein: 

3 the network is a first network in a plurality of networks; and 
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4 the computer-readable medium further comprises instructions which, when executed by 

5 the one or more processors, cause the one or more processors to carry out the 

6 steps of: 

7 receiving a request from a user to employ a particular rule in managing a second 

8 network, separate from the first network; and 

9 distributing to a device on the second network the one or more RBML documents 
1 0 storing the particular rule . 

1 32. (Cuixently Amended) A computer-readable storage medium carrying one or more 

2 sequences of instmctions for defining a Rule-Based Markup Language ("RBML") to 

3 describe a set of lailes for managing a network, which instmctions, when executed by one 

4 or more processors, cause the one or more processors to carry out the steps of: 

5 creating one or more RBML documents for storing the set of rules, wherein the one or 

6 more RBML documents include one or more tags defining one or more rule 

7 elements, and wherein: 

8 a RBML document storing a symptom-event rule from the set of rules includes: 

9 an event tag identifying a particular event occurring on the network; and 

10 a symptom tag identifying a symptom as a generalized abstraction of the 

1 1 particular event; and 

12 a RBML document storing a problem-diagnosis i-ule from the set of rules 

13 includes: 

14 a problem-definition tag describing a problem; and 

15 a correlation tag identifying a correlation between one or more symptoms, 

16 wherein the one or more symptoms are defined in one or more 

17 symptom tags that include one or more pre-defined indicators 

18 associated with the one or more symptoms; and 

19 generating, from information stored in one or more tags of the one or more RBML 

20 documents, one or more sequences of instmctions, which instmctions, when 

21 executed by one or more processors, cause the one or more processors to carry out 

22 the steps of: 

23 collecting and storing symptom-related data about one or more symptoms, 

24 wherein collecting and storing the symptom-related data includes 
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25 monitoring the network for one or more network events identified in the 

26 symptom-event rule; and 

27 detecting a problem within the network, wherein detecting the problem includes 

28 applying the problem-diagnosis rule to the symptom-related data. 

1 33. (Currently Amended) A computer-readable storage medium as recited in Claim 32, 

2 wherein the instructions for detecting a problem within the network further comprise 

3 instructions for carrying out the steps of: 

4 comparing the symptom-related data to the one or more pre-defined indicators associated 

5 with the one or more symptoms to determine whether a particular symptom exists 

6 in the symptom-related data; 

7 repeating the step of comparing the symptom-related data for all symptoms identified in 

8 the correlation tag of the RBML document storing the problem-diagnosis rule; 

9 and 

10 only if all symptoms identified in the correlation tag exist, determining that the problem 

1 1 identified in the problem-definition tag is detected. 

1 34. (Currently Amended) A computer-readable storage medium as recited in Claim 32, 

2 wherein the RBML document storing the symptom-event rule further includes: 

3 a profile tag identifying a particular network device; and 

4 a command tag identifying a data-collection command, wherein the data-collection 

5 command, when executed on the particular network device, returns symptom- 

6 related data associated with the particular network device. 

1 35. (Currently Amended) A computer-readable storage medium as recited in Claim 32, 

2 wherein: 

3 the instructions for creating one or more RBML documents further comprise instructions 

4 for carrying out the step of creating a RBML document for storing a problem- 

5 correction rule defining one or more corrective actions capable of correcting the 

6 problem within the network; and 

7 the instructions for generating one or more sequences of instructions, by using 

8 information stored in one or more tags of one or more RBML documents, further 
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comprise instractions for carrying out the step of recommending to a user the one 

or more corrective actions defined in the RBML document storing the problem- 
correction rule. 
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